The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0195 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-32700:
      LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained     from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This     also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3946 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3946-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     November 05, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : context     Version        : 2020.03.10.20200331-1+deb11u1

    Context a general-purpose document processor was affected by     CVE-2023-32700 fix that by default disable luasocket.

    This bugfix release, fix the mtxrun program used at install time     of context (postinst) that was broken by CVE-2023-32700 patch.

    For Debian 11 bullseye, this problem has been fixed in version     2020.03.10.20200331-1+deb11u1.

    We recommend that you upgrade your context packages.

    For the detailed security status of context please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/context

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3661 advisory.

    [9:20200406-26]
    - Resolves: #2209872, CVE-2023-32700

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2285-1 advisory.

    - CVE-2023-32700: Fixed arbitrary code execution in LuaTeX (bsc#1211389).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2287-1 advisory.

    cups-filters:

    - CVE-2023-24805: Fixed a remote code execution in the beh backend (bsc#1211340).

    texlive:

    - CVE-2023-32700: Fixed arbitrary code execution in LuaTeX (bsc#1211389).

    poppler:

    - Added missing header file goo/GooCheckedOps.h. Without it, other packages       using poppler as a library might fail to compile since our public headers now       depend on it. (bsc#1211450)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the texlive-20200406-26.el9 build changelog.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5406 advisory.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-38094d905c advisory.

    Fixes CVE-2023-32700. Also fixes issues with mptopdf.pl, thumb2pdf.pl, and mtxrun.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6183:03 advisory.

    * texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has texlive-base packages installed that are affected by a vulnerability:

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6115-1 advisory.

    Max Chernoff discovered that LuaTeX (TeX Live) did not properly disable shell escape. An attacker could     possibly use this issue to execute arbitrary shell commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d261122726 advisory.

    Fix CVE-2023-32700

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3661 advisory.

    The texlive packages contain TeXLive, an implementation of TeX for Linux or UNIX systems.

    Security Fix(es):

    * texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0153 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-32700:
    LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6081:02 advisory.

    * texlive: arbitrary code execution allows document complied with older     version (CVE-2023-32700)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3427 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3427-2                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     May 31, 2023                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : texlive-bin     Version        : 2018.20181218.49446-1+deb10u2     CVE ID         : CVE-2019-18604     Debian Bug     : 1036891

    It was discovered that the patch to fix CVE-2023-32700 in texlive-bin, released     as DLA-3427-1, was incomplete and caused an error when running the lualatex     command.

    The following security vulnerability has been addressed as well.

    CVE-2019-18604

         A flaw was found in axohelp in axodraw2. The sprintf function is          mishandled which may cause a stack overflow error.

    For Debian 10 buster, this problem has been fixed in version     2018.20181218.49446-1+deb10u2.

    We recommend that you upgrade your texlive-bin packages.

    For the detailed security status of texlive-bin please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/texlive-bin

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
239406	TencentOS Server 3: texlive (TSSA-2023:0195)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
210378	Debian dla-3946 : context - security update	Nessus	Debian Local Security Checks	2024/11/5	2024/11/5	high
226645	Linux Distros Unpatched Vulnerability : CVE-2023-32700	Nessus	Misc.	2025/3/5	2025/9/2	high
177521	Oracle Linux 8 / 9 : texlive (ELSA-2023-3661)	Nessus	Oracle Linux Local Security Checks	2023/6/22	2025/9/9	high
176354	SUSE SLES15: libkpathsea6 / libptexenc1 / libsynctex1 / libtexlua52-5 / etc (SUSE-SU-2023:2285-1)	Nessus	SuSE Local Security Checks	2023/5/25	2026/6/25	high
176355	SUSE SLES15: cups-filters / cups-filters-devel / libkpathsea6 / libpoppler-cpp0 / etc (SUSE-SU-2023:2287-1)	Nessus	SuSE Local Security Checks	2023/5/25	2026/6/25	high
191402	CentOS 9 : texlive-20200406-26.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
176150	Debian DSA-5406-1 : texlive-bin - security update	Nessus	Debian Local Security Checks	2023/5/20	2023/8/2	high
176499	Fedora 38 : texlive-base (2023-38094d905c)	Nessus	Fedora Local Security Checks	2023/5/30	2024/11/15	high
292399	MiracleLinux 8 : texlive-20180414-29.el8 (AXSA:2023-6183:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
242701	NewStart CGSL MAIN 7.02 : texlive-base Vulnerability (NS-SA-2025-0137)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
176478	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 : TeX Live vulnerability (USN-6115-1)	Nessus	Ubuntu Local Security Checks	2023/5/30	2024/8/27	high
176659	Fedora 37 : texlive-base (2023-d261122726)	Nessus	Fedora Local Security Checks	2023/6/4	2024/11/14	high
177428	RHEL 8 / 9 : texlive (RHSA-2023:3661)	Nessus	Red Hat Local Security Checks	2023/6/19	2024/11/8	high
236189	Alibaba Cloud Linux 3 : 0153: texlive (ALINUX3-SA-2023:0153)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
293666	MiracleLinux 9 : texlive-20200406-26.el9 (AXSA:2023-6081:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
176221	Debian dla-3427 : libkpathsea-dev - security update	Nessus	Debian Local Security Checks	2023/5/23	2025/1/22	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical